support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 10 )

Updated On: 31-Jul-2026
Page 10 of 133
PDF with 1065 Questions

Which IOS jailbreaking technique patches the kernel during the device boot so that it becomes jailbroken after each successive reboot?

  1. Tethered jailbreaking
  2. Semi-untethered jailbreaking
  3. Semi-tethered jailbreaking
  4. Untethered jailbreaking

Answer(s): D

Explanation:

D is correct because untethered jailbreaking allows the device to remain jailbroken after each reboot by permanently modifying the kernel.
Justification for D (Untethered Jailbreaking)
Untethered jailbreaking is characterized by its ability to modify the device's kernel during the initial boot process, enabling persistent jailbreak functionality across reboots. This method ensures that the device retains its jailbroken status without requiring any further intervention from the user post-restart. The modification is achieved through techniques that alter the bootloader and kernel code, making the jailbreak permanent until the operating system is updated or restored.
Evaluation of Other Options

A: Tethered Jailbreaking : This technique requires the device to be re-jailbroken at every reboot. The jailbreak is loaded through a computer, making it impractical for users who need portability, as it cannot maintain the jailbreak independently of an external device.
B: Semi-untethered Jailbreaking : Similar to tethered jailbreaking, this method allows the device to reboot without a computer but requires a specific app to be run post-reboot for the jailbreak to reinitialize. Therefore, it does not provide the same level of permanence as untethered jailbreaking.
C: Semi-tethered Jailbreaking : This method allows for the device to reboot, but with limitations.
While the device can function, certain jailbreak features become inaccessible without reactivating the jailbreak through a computer or app, indicating a lack of full functionality post-reboot.
In summary, untethered jailbreaking provides the most seamless and permanent solution for maintaining a jailbreak across multiple device restarts, making it the preferred method among users seeking stability and functionality.


Reference:

1. https://www.redmondpie.com/what-is-jailbreaking-and-how-it-works-fully-explained/ 2. https://www.geeksforgeeks.org/jailbreaking-iphone-what-you-need-to-know/ 3. https://www.howtogeek.com/677949/how-to-jailbreak-your-iphone-or-ipad/



Stella, a professional hacker, performs an attack on web services by exploiting a vulnerability that provides additional routing information in the SOAP header to support asynchronous communication. This further allows the transmission of web-service requests and response messages using different TCP connections.
Which of the following attack techniques is used by Stella to compromise the web services?

  1. Web services parsing attacks
  2. WS-Address spoofing
  3. SOAPAction spoofing
  4. XML injection

Answer(s): B

Explanation:

B is correct because WS-Address spoofing exploits routing information in SOAP headers, allowing attackers to manipulate communication endpoints.
Reasoning: WS-Addressing is a specification that facilitates message routing in web services by including address information within SOAP headers. In this context, an attacker like Stella can spoof WS-Address details, redirecting messages intended for legitimate services to malicious endpoints. This manipulation can lead to unauthorized data retrieval or injection, significantly compromising the security and integrity of web services operating in an asynchronous environment.
Critical Evaluation of Other Options:

A: Web services parsing attacks: While these attacks target the way web services process incoming data, the scenario specifically involves routing information manipulation, which is not merely a parsing issue. Thus, this option does not directly align with the method employed by Stella.
C: SOAPAction spoofing: Though SOAPAction spoofing entails sending requests with forged SOAPAction headers, which can mislead services, it does not specifically exploit routing information within SOAP headers for asynchronous communications. Therefore, it does not fit the context of Stella's attack.
D: XML injection: This attack involves inserting malicious XML into requests to manipulate backend processing. However, the question focuses on exploiting routing mechanisms in SOAP headers rather than manipulating the content itself. As such, it diverges from the technique utilized by Stella.
References:
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=ws-addressing https://www.owasp.org/index.php/Web_Services_Security_Cheat_Sheet https://www.rsa.com/en-us/blog/2014-04/the-sockpuppet-attack-against-web-services.html


Reference:

References:
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=ws-addressing https://www.owasp.org/index.php/Web_Services_Security_Cheat_Sheet https://www.rsa.com/en-us/blog/2014-04/the-sockpuppet-attack-against-web-services.html



Attacker Steve targeted an organization’s network with the aim of redirecting the company’s web traffic to another malicious website. To achieve this goal, Steve performed DNS cache poisoning by exploiting the vulnerabilities in the DNS server software and modified the original IP address of the target website to that of a fake website.
What is the technique employed by Steve to gather information for identity theft?

  1. Pharming
  2. Skimming
  3. Pretexting
  4. Wardriving

Answer(s): A

Explanation:

A: Pharming is correct because it involves redirecting users from legitimate websites to fraudulent ones to gather sensitive information.
Pharming exploits vulnerabilities within DNS servers to alter the resolution of domain names, steering users to malicious sites without their consent or awareness. In this scenario, Steve executed DNS cache poisoning to change the actual IP address of a target website, thereby enabling him to collect sensitive information from unsuspecting users who believed they were interacting with a legitimate resource. This technique effectively facilitates identity theft by allowing attackers to harvest credentials and personal information.
Counterarguments for other options:
B: Skimming involves capturing card information from physical or electronic transactions, primarily in point-of-sale environments. It does not pertain to redirecting online traffic or manipulating DNS entries, making it irrelevant in the context of this attack.
C: Pretexting refers to the act of creating a fabricated scenario to extract information from individuals.
While it is a form of social engineering, it does not encompass the technical manipulation of DNS records or website redirection, distinguishing it from the method used by Steve.
D: Wardriving entails searching for Wi-Fi networks while driving around, often for the purpose of finding unsecured connections. This approach is unrelated to DNS manipulation and does not involve the redirection of web traffic or identity theft within an online context.
References:
https://www.us-cert.cisa.gov/ncas/tips/ST06-001 https://www.cloudflare.com/learning/dns/what-is-dns-cache-poisoning/ https://owasp.org/www-community/Pharming


Reference:

References:
https://www.us-cert.cisa.gov/ncas/tips/ST06-001 https://www.cloudflare.com/learning/dns/what-is-dns-cache-poisoning/ https://owasp.org/www-community/Pharming



What is the port to block first in case you are suspicious that an IoT device has been compromised?

  1. 22
  2. 48101
  3. 80
  4. 443

Answer(s): B

Explanation:

Blocking port 48101 is the most effective initial action when suspecting that an IoT device is compromised, as this port is commonly associated with various vulnerabilities found in IoT devices.
Port 48101 is often exploited for unauthorized access and command and control (C&C) communication in compromised devices. IoT devices frequently use this port for sending data, making it a prime target for malicious actors intending to exfiltrate information or maintain control over the device. Blocking this port can prevent further intrusion or data leakage, mitigating the threat effectively.
Evaluation of Other Options:
Port 22 (SSH) : While SSH (port 22) is critical for secure remote management, it is a standard service that many legitimate configurations use for secure communication. Blocking this port might disrupt essential management functionalities without directly addressing the immediate suspicion of compromise.
Port 80 (HTTP) : This port is used for unrestricted web traffic, which is integral to the functioning of many IoT devices for user interfaces and updates. Blocking port 80 could impair the operational capabilities of the device and limit legitimate access.
Port 443 (HTTPS) : Similarly, port 443 is essential for secure web traffic. Disabling HTTPS access can prevent secure communications and software updates, rendering the device vulnerable to newer attacks and exposing it to additional risks.
In summary, while blocking ports 22, 80, or 443 may preserve security in specific contexts, port 48101 specifically relates to the common exploit strategies for IoT device vulnerabilities. This makes it the most prudent initial choice when faced with a suspected compromise.
References:
https://www.securityweek.com/iot-devices-take-first-hit-among-cyber-attackers https://www.csoonline.com/article/3602328/the-rise-of-iot-attacks-and-what-you-can-do-about-it.html https://www.forbes.com/sites/bernardmarr/2021/05/03/the-risks-and-challenges-of-iot-devices/?
sh=3cd5a4b64197


Reference:

References:
https://www.securityweek.com/iot-devices-take-first-hit-among-cyber-attackers https://www.csoonline.com/article/3602328/the-rise-of-iot-attacks-and-what-you-can-do-about-it.html https://www.forbes.com/sites/bernardmarr/2021/05/03/the-risks-and-challenges-of-iot-devices/?
sh=3cd5a4b64197



Clark is a professional hacker. He created and configured multiple domains pointing to the same host to switch quickly between the domains and avoid detection. Identify the behavior of the adversary in the above scenario.

  1. Unspecified proxy activities
  2. Use of command-line interface
  3. Data staging
  4. Use of DNS tunneling

Answer(s): A

Explanation:

A is correct because the described behavior indicates the use of unspecified proxy activities to obscure the hacker's identity and maintain anonymity.
In the scenario, Clark's strategy of creating multiple domains points to a behavior typical of adversaries aiming to obfuscate their true source and avoid detection by security systems. This practice is characterized by the employment of proxies, where the original source of traffic is masked through various domains that route through a singular host. The ability to switch domains seamlessly enhances the sophistication of evasion tactics utilized in cyber attacks.
Evaluation of Incorrect Options:
B: Use of command-line interface: This option is not relevant as it focuses on a technique for system interaction rather than a method of evasion or anonymity. Command-line usage does not inherently involve domain manipulation for obfuscation.
C: Data staging: While data staging refers to the process of preparing and organizing data for exfiltration or further exploitation, this does not align with the domain-switching behavior. Clark's focus is on maintaining access and anonymity rather than merely preparing data for later use.
D: Use of DNS tunneling: This technique allows data to be exfiltrated through DNS queries, but the scenario does not explicitly suggest that Clark is using DNS records for covert data transfer. Instead, it revolves around creating domains for evasion, which is a broader activity than just tunneling.
In conclusion, option A captures the essence of the adversarial behavior due to its focus on maintaining anonymity through obfuscation, differentiating it from other listed activities not directly aimed at covering tracks.
https://csrc.nist.gov/publications/detail/sp/800-94/final https://www.cisecurity.org/white-papers/understanding-proxies-and-their-role-in-network-security/ https://www.owasp.org/index.php/Proxy



What firewall evasion scanning technique make use of a zombie system that has low network activity as well as its fragment identification numbers?

  1. Packet fragmentation scanning
  2. Spoof source address scanning
  3. Decoy scanning
  4. Idle scanning

Answer(s): D

Explanation:

D is correct because idle scanning utilizes a third-party "zombie" host to infer the open ports of a target system without directly interacting with it.
Idle scanning is an advanced stealth technique that exploits specific TCP/IP characteristics and sequence number prediction to ascertain the status of a target port. By sending TCP packets to the target while controlling a low-activity zombie host, the scanner can analyze the responses to identify open or closed ports based on the zombie's IP and sequence number. This technique is particularly effective in evading detection, as the target interacts solely with the idle zombie, minimizing the risk of triggering alert mechanisms.
Evaluation of Other Options:

A: Packet fragmentation scanning primarily involves dividing packets into smaller fragments to evade packet filters.
While this method enhances stealth, it does not engage a zombie host and cannot leverage sequence number prediction, making it less effective for stealth penetration.
B: Spoof source address scanning involves disguising the origin of packets to mislead the target’s response. It doesn't employ a zombie system, nor does it utilize sequence numbers, making it less sophisticated than idle scanning concerning stealth.
C: Decoy scanning obscures the true scanner’s IP address with additional decoy packets sent from different addresses. Although it enhances anonymity, it lacks the low-activity threshold of zombie systems and does not incorporate sequence number analysis, leading to a higher likelihood of detection.
For further understanding, consult the following references:
https://www.cisecurity.org/white-papers/cis-control-12 https://www.sans.edu/cyber-research/security-resources/white-papers/35949/ https://www.nsslabs.com/solutions/network-security/firewall-research/



By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login and password in plaintext.
Which file do you have to clean to clear the password?

  1. .xsession-log
  2. .profile
  3. .bashrc
  4. .bash_history

Answer(s): D

Explanation:

The correct answer is D. .bash_history, as it logs user commands executed in the shell, including those that could expose plaintext passwords.
The .bash_history file is specifically designed to store the history of commands entered in the Bash shell, allowing users to revisit and execute previously used commands. This includes any commands where passwords were entered in plaintext, making it essential to clean this file to prevent malicious users from retrieving sensitive information. By purging this file, you effectively mitigate the risk of exposing the plaintext credentials that were inadvertently stored during your session.
In contrast, the other options are less relevant to the issue of plaintext password storage:

A: .xsession-log : This file generally logs X Window session startup processes and may not specifically capture user command input, thus less likely to contain plaintext passwords.
B: .profile : This is a startup file executed by the Bourne shell that sets environmental variables and shell configuration for a user. It is not intended to track command history and won't contain sensitive user input after the session is closed.
C: .bashrc : Similar to .profile, this file configures the shell environment for interactive non-login shells and may contain user-defined functions and aliases, but it does not log command history, therefore it is not pertinent to password clearing.
In conclusion, to effectively secure the system and safeguard against potential credential leakage, clearing the .bash_history file is imperative.
References:
https://www.gnu.org/software/bash/manual/html_node/Bash-History.html https://www.cyberciti.biz/faq/howto-bash-history-file/ https://www.computerhope.com/unix/bash.htm


Reference:

References:
https://www.gnu.org/software/bash/manual/html_node/Bash-History.html https://www.cyberciti.biz/faq/howto-bash-history-file/ https://www.computerhope.com/unix/bash.htm



Jack, a disgruntled ex-employee of Incalsol Ltd., decided to inject fileless malware into Incalsol's systems. To deliver the malware, he used the current employees' email IDs to send fraudulent emails embedded with malicious links that seem to be legitimate.
When a victim employee clicks on the link, they are directed to a fraudulent website that automatically loads Flash and triggers the exploit.
What is the technique used by Jack to launch the fileless malware on the target systems?

  1. In-memory exploits
  2. Legitimate applications
  3. Script-based injection
  4. Phishing

Answer(s): A

Explanation:

A: In-memory exploits correctly identifies the technique Jack used, as it relies on exploiting runtime vulnerabilities with no file system persistence.
The malicious emails sent by Jack serve as a vector for the initial infection, utilizing social engineering techniques characteristic of phishing.
When victims click on the embedded links, they are redirected to a fraudulent website that leverages the exploit in Flash, executing code directly in the memory of the browser or related processes. This method converts the malware into a fileless format, which is more resistant to traditional detection measures that scan for files on disk.
Option B, Legitimate applications, is incorrect as it implies the use of trusted applications to execute harmful code, but in this scenario, the exploitation actively occurs through a web browser and its plugins. Options C, Script-based injection, does not apply here because Jack's method specifically involves exploiting a software vulnerability rather than injecting scripts into existing processes or other scripts. Lastly, while D. Phishing is a component of the attack, it gauges the social engineering aspect rather than the technical execution, failing to capture the essence of the in-memory exploit utilized to launch the fileless malware.
References:
https://www.csoonline.com/article/3537014/what-is-a-fileless-malware-attack.html https://www.fireeye.com/blog/threat-research/2021/07/what-is-fileless-malware.html https://www.imperva.com/learn/application-security/fileless-malware/


Reference:

References:
https://www.csoonline.com/article/3537014/what-is-a-fileless-malware-attack.html https://www.fireeye.com/blog/threat-research/2021/07/what-is-fileless-malware.html https://www.imperva.com/learn/application-security/fileless-malware/



  PDF
Viewing page 10 of 133
Viewing questions 46 - 50 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!